CVE-2026-22728
Medium · 4.9CVSS
4.9
EPSS
0.4%
Published
Feb 26, 2026
CISA due date
—
The record
Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim SealedSecret to the rotate endpoint with the annotation sealedsecrets.bitnami.com/cluster-wide=true injected into the template metadata, a remote attacker can obtain a rotated version of the secret that is cluster-wide. This bypasses original "strict" or "namespace-wide" constraints, allowing the attacker to retarget and unseal the secret in any namespace or under any name to recover the plaintext credentials.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/bitnami-labs/sealed-secrets | 0 | 0.36.0 |
| Chainguard | kots | 0 | 1.129.4-r2 |
| Wolfi | kots | 0 | 1.129.4-r2 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260317T205859-150000.1.152.1 |
Related vulnerabilities
- CVE-2026-35172 Distribution is a toolkit to pack, ship, store, and deliver container content. Also affects kots
- CVE-2026-33540 Distribution is a toolkit to pack, ship, store, and deliver container content. Also affects kots
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects kots
- CVE-2026-33762 go-git is an extensible git implementation library written in pure Go. Also affects kots
- CVE-2026-4427 Rejected reason: Duplicate of CVE-2026-32286 Also affects kots
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects kots
- CVE-2026-25934 go-git is a highly extensible git implementation library written in pure Go. Also affects kots
- CVE-2026-24137 sigstore framework is a common go library shared across sigstore services and clients. Also affects kots